golang/go · error

overflowing coordinate

Error message

overflowing coordinate

What it means

Thrown by nistCurve.pointFromAffine (nistec.go:146) when a coordinate's bit-length exceeds curve.params.BitSize. Guards the fixed-width FillBytes buffer against overflow. Sibling of ecdsa error 242 at the elliptic-curve layer.

Source

Thrown at src/crypto/elliptic/nistec.go:146

	if x.Sign() == 0 && y.Sign() == 0 {
		return false
	}
	_, err := curve.pointFromAffine(x, y)
	return err == nil
}

func (curve *nistCurve[Point]) pointFromAffine(x, y *big.Int) (p Point, err error) {
	// (0, 0) is by convention the point at infinity, which can't be represented
	// in affine coordinates. See Issue 37294.
	if x.Sign() == 0 && y.Sign() == 0 {
		return curve.newPoint(), nil
	}
	// Reject values that would not get correctly encoded.
	if x.Sign() < 0 || y.Sign() < 0 {
		return p, errors.New("negative coordinate")
	}
	if x.BitLen() > curve.params.BitSize || y.BitLen() > curve.params.BitSize {
		return p, errors.New("overflowing coordinate")
	}
	// Encode the coordinates and let SetBytes reject invalid points.
	byteLen := (curve.params.BitSize + 7) / 8
	buf := make([]byte, 1+2*byteLen)
	buf[0] = 4 // uncompressed point
	x.FillBytes(buf[1 : 1+byteLen])
	y.FillBytes(buf[1+byteLen : 1+2*byteLen])
	return curve.newPoint().SetBytes(buf)
}

func (curve *nistCurve[Point]) pointToAffine(p Point) (x, y *big.Int) {
	out := p.Bytes()
	if len(out) == 1 && out[0] == 0 {
		// This is the encoding of the point at infinity, which the affine
		// coordinates API represents as (0, 0) by convention.
		return new(big.Int), new(big.Int)
	}
	byteLen := (curve.params.BitSize + 7) / 8

View on GitHub (pinned to b6b368adc5)

Solutions

1. Match the point's coordinates to the correct curve (BitSize).
2. Reduce coordinates modulo the field prime before use.
3. Parse points via elliptic.UnmarshalCompressed/Unmarshal which validates against the curve.

Example fix

// before
// p384X assigned to a P256 curve object -> x.BitLen() > 256
_, _ = p256.ScalarMult(p384X, p384Y, k) // -> error 254

// after
_, _ = p384.ScalarMult(p384X, p384Y, k)

bs := curve.Params().BitSize
if x.BitLen() > bs || y.BitLen() > bs {
    return fmt.Errorf("coordinate overflows %d-bit curve", bs)
}

func coordsFitBitSize(curve elliptic.Curve, x, y *big.Int) bool {
    bs := curve.Params().BitSize
    return x.BitLen() <= bs && y.BitLen() <= bs
}

When it happens

Trigger: Reached via elliptic curve operations when x.BitLen() > BitSize || y.BitLen() > BitSize — e.g. passing a P-384 coordinate to a P-256 nistCurve, or an unreduced value larger than the field.

Common situations: Curve mismatch between the point and the nistCurve object; coordinates derived from a hash without masking; deserialization that assigned the wrong curve.

Related errors

• negative coordinate
• crypto/dsa: invalid public key
• crypto/dsa: invalid ParameterSizes
• crypto/dsa: parameters not set up before generating key
• crypto/ecdh: private key and public key curves do not match

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/5620b148aadee65e. Report an issue: GitHub.